This is the current patch from Luke Leighton <lckl@samba-tng.org> to add a

degree of seperation betwen reading/writing the raw NamedPipe SMB packets
and the matching operations inside smbd's RPC components.

This patch is designed for no change in behaviour, and my tests hold that to be
true.  This patch does however allow for the future loadable modules interface
to specify function pointers in replacement of the fixed state.

The pipes_struct has been split into two peices, with smb_np_struct taking the
information that should be generic to where the data ends up.

Some other minor changes are made: we get another small helper function in
util_sock.c and some of the original code has better failure debugs and
variable use. (As per on-list comments).

Andrew Bartlett

3 files changed, 18 insertions, 14 deletions

diff --git a/source/smbd/ipc.c b/source/smbd/ipc.c
index 4047ffa8d70..f84f3048e97 100644
--- a/source/smbd/ipc.c
+++ b/source/smbd/ipc.c
@@ -163,8 +163,9 @@ void send_trans_reply(char *outbuf,
  Start the first part of an RPC reply which began with an SMBtrans request.
 ****************************************************************************/
 
-static BOOL api_rpc_trans_reply(char *outbuf, pipes_struct *p)
+static BOOL api_rpc_trans_reply(char *outbuf, smb_np_struct *p)
 {
+	BOOL is_data_outstanding;
 	char *rdata = malloc(p->max_trans_reply);
 	int data_len;
 
@@ -173,12 +174,13 @@ static BOOL api_rpc_trans_reply(char *outbuf, pipes_struct *p)
 		return False;
 	}
 
-	if((data_len = read_from_pipe( p, rdata, p->max_trans_reply)) < 0) {
+	if((data_len = read_from_pipe( p, rdata, p->max_trans_reply,
+					&is_data_outstanding)) < 0) {
 		SAFE_FREE(rdata);
 		return False;
 	}
 
-	send_trans_reply(outbuf, NULL, 0, rdata, data_len, p->out_data.current_pdu_len > data_len);
+	send_trans_reply(outbuf, NULL, 0, rdata, data_len, is_data_outstanding);
 
 	SAFE_FREE(rdata);
 	return True;
@@ -188,7 +190,7 @@ static BOOL api_rpc_trans_reply(char *outbuf, pipes_struct *p)
  WaitNamedPipeHandleState 
 ****************************************************************************/
 
-static BOOL api_WNPHS(char *outbuf, pipes_struct *p, char *param, int param_len)
+static BOOL api_WNPHS(char *outbuf, smb_np_struct *p, char *param, int param_len)
 {
 	uint16 priority;
 
@@ -211,7 +213,7 @@ static BOOL api_WNPHS(char *outbuf, pipes_struct *p, char *param, int param_len)
  SetNamedPipeHandleState 
 ****************************************************************************/
 
-static BOOL api_SNPHS(char *outbuf, pipes_struct *p, char *param, int param_len)
+static BOOL api_SNPHS(char *outbuf, smb_np_struct *p, char *param, int param_len)
 {
 	uint16 id;
 
@@ -259,7 +261,7 @@ static int api_fd_reply(connection_struct *conn,uint16 vuid,char *outbuf,
 		 	int suwcnt,int tdscnt,int tpscnt,int mdrcnt,int mprcnt)
 {
 	BOOL reply = False;
-	pipes_struct *p = NULL;
+	smb_np_struct *p = NULL;
 	int pnum;
 	int subcommand;
 
diff --git a/source/smbd/nttrans.c b/source/smbd/nttrans.c
index 464790d158a..6e03d485d2c 100644
--- a/source/smbd/nttrans.c
+++ b/source/smbd/nttrans.c
@@ -466,7 +466,7 @@ to open_mode 0x%x\n", (unsigned long)desired_access, (unsigned long)share_access
 static int nt_open_pipe(char *fname, connection_struct *conn,
 			char *inbuf, char *outbuf, int *ppnum)
 {
-	pipes_struct *p = NULL;
+	smb_np_struct *p = NULL;
 
 	uint16 vuid = SVAL(inbuf, smb_uid);
 	int i;
diff --git a/source/smbd/pipes.c b/source/smbd/pipes.c
index cd8a56a5d2a..8f6f6f39c4d 100644
--- a/source/smbd/pipes.c
+++ b/source/smbd/pipes.c
@@ -45,7 +45,7 @@ int reply_open_pipe_and_X(connection_struct *conn,
 	pstring fname;
 	pstring pipe_name;
 	uint16 vuid = SVAL(inbuf, smb_uid);
-	pipes_struct *p;
+	smb_np_struct *p;
 	int smb_ofun = SVAL(inbuf,smb_vwv8);
 	int size=0,fmode=0,mtime=0,rmode=0;
 	int i;
@@ -116,7 +116,7 @@ int reply_open_pipe_and_X(connection_struct *conn,
 ****************************************************************************/
 int reply_pipe_write(char *inbuf,char *outbuf,int length,int dum_bufsize)
 {
-	pipes_struct *p = get_rpc_pipe_p(inbuf,smb_vwv0);
+	smb_np_struct *p = get_rpc_pipe_p(inbuf,smb_vwv0);
 	size_t numtowrite = SVAL(inbuf,smb_vwv1);
 	int nwritten;
 	int outsize;
@@ -154,7 +154,7 @@ int reply_pipe_write(char *inbuf,char *outbuf,int length,int dum_bufsize)
 
 int reply_pipe_write_and_X(char *inbuf,char *outbuf,int length,int bufsize)
 {
-	pipes_struct *p = get_rpc_pipe_p(inbuf,smb_vwv2);
+	smb_np_struct *p = get_rpc_pipe_p(inbuf,smb_vwv2);
 	size_t numtowrite = SVAL(inbuf,smb_vwv10);
 	int nwritten = -1;
 	int smb_doff = SVAL(inbuf, smb_vwv11);
@@ -210,11 +210,13 @@ int reply_pipe_write_and_X(char *inbuf,char *outbuf,int length,int bufsize)
 ****************************************************************************/
 int reply_pipe_read_and_X(char *inbuf,char *outbuf,int length,int bufsize)
 {
-	pipes_struct *p = get_rpc_pipe_p(inbuf,smb_vwv2);
+	smb_np_struct *p = get_rpc_pipe_p(inbuf,smb_vwv2);
 	int smb_maxcnt = SVAL(inbuf,smb_vwv5);
 	int smb_mincnt = SVAL(inbuf,smb_vwv6);
 	int nread = -1;
 	char *data;
+	BOOL unused;
+
 	/* we don't use the offset given to use for pipe reads. This
            is deliberate, instead we always return the next lump of
            data on the pipe */
@@ -228,7 +230,7 @@ int reply_pipe_read_and_X(char *inbuf,char *outbuf,int length,int bufsize)
 	set_message(outbuf,12,0,True);
 	data = smb_buf(outbuf);
 
-	nread = read_from_pipe(p, data, smb_maxcnt);
+	nread = read_from_pipe(p, data, smb_maxcnt, &unused);
 
 	if (nread < 0)
 		return(UNIXERROR(ERRDOS,ERRnoaccess));
@@ -248,7 +250,7 @@ int reply_pipe_read_and_X(char *inbuf,char *outbuf,int length,int bufsize)
 ****************************************************************************/
 int reply_pipe_close(connection_struct *conn, char *inbuf,char *outbuf)
 {
-	pipes_struct *p = get_rpc_pipe_p(inbuf,smb_vwv0);
+	smb_np_struct *p = get_rpc_pipe_p(inbuf,smb_vwv0);
 	int outsize = set_message(outbuf,0,0,True);
 
 	if (!p)
@@ -256,7 +258,7 @@ int reply_pipe_close(connection_struct *conn, char *inbuf,char *outbuf)
 
 	DEBUG(5,("reply_pipe_close: pnum:%x\n", p->pnum));
 
-	if (!close_rpc_pipe_hnd(p, conn))
+	if (!close_rpc_pipe_hnd(p))
 		return ERROR_DOS(ERRDOS,ERRbadfid);
 
 	return(outsize);